Structured logging is a standard to log with the goal of creating easy machine-passable information. This enables us to quickly search, analyse and group this data.
To create structured logs one must follow these rules
- Use a data format for computers. JSON and XML are the most common.
- Log parameters / variables as properties of this data format
- Have a unique identifier for the same group / log. This could easily be the message
Example of a structured log
{
"message": "Can not find user",
"user_id": "XAB123",
"timestamp": "2025-04-14T23:55:00Z",
"endpoint": "/my/cool/route/XAB123",
"loglevel": "warning"
}A non structured version could be the follow string: [23:55:00] WARN: Can not find user with ID XAB123 from endpoint /my/cool/route/XAB123.
Semi structured logs are logs that follow some rules, but not all. Whilst structured logging offer advantages, especially with the help of tools, they are not as readable as unstructured or semi structured logs.
Another drawback is that they explode in size.
One must be careful and think what metadata/variables to log as they can contain PII.
Reference
Structured logging is the practice of logging application and server errors or access events in a well-structured and consistent format that can be easily read, searched, and analyzed by any application or an interested individual.
— takeaway from Structured Logging highlights
The most common structured logging format is JSON
— data structure from Structured Logging highlights